What you yourself must or can do
In order to gain information on, access to, supplementation, correction, erasure and/or blocking of your personal data, or in the event that you object to the specific processing of your personal data, you must apply to the controller within the company or institution in question (hereinafter: organisation). This could be: the Municipal Executive for your municipality, the general manager of your bank, the Board of your insurance company, etc. You are advised to contact the organisation in question (by telephone) on how to submit your request. Some organisations have special forms for this.
If, four weeks after your request, you have received no response, or a response that you are not satisfied with, you can take one of the steps described below:
- If an organisation or trade association has appointed a data protection officer, you can contact him with your questions and complaints. When doing so, please bear in mind the periods applicable for the submission of requests to the Dutch DPA, applications to courts of law, or notices of objection to a government institution, as indicated below.
- Where a code of conduct approved by the Dutch DPA applies in the branch of industry in question and this includes rules on the settlement of disputes, you will be able to take action on the basis of these rules. Where applicable, you can request a copy of the code of conduct from the organisation in question. When doing so, please bear in mind the periods applicable for the submission of requests to the Dutch DPA, applications to courts of law, or notices of objection to a government institution, as indicated below.
- Where your case concerns decisions made by government institutions in respect of requests for the access to, correction, supplementation, erasure or blocking of data, or to an objection, you will be entitled to lodge an objection to this decision within six weeks. Please note that you must lodge your objection with the government institution itself. If this institution has taken a decision on a notice of objection submitted to it and you disagree with this decision, you will have a period of six weeks to appeal to a court of law.
- If the organisation is not a government body, you will be allowed a period of six weeks to submit a notice of objection to a court of law, with the request that the organisation be obliged to observe a court order. The court could, for example, order the organisation in question to erase certain data from its computer systems.
The following applies for points 3 and 4: before appealing to the court, you could opt to submit a request for mediation to the Dutch DPA. This request for mediation must be submitted within six weeks of the date on which the government body decided on your objection, or within six weeks of the date of the decision made by a non-government body. The submission of a request for mediation to the Dutch DPA will suspend the period during which you are able to appeal to a court. Following termination of the Dutch DPA’s mediation, you will still have a period of six weeks in which to appeal to a court of law.
If you opt to submit a request for mediation to the Dutch DPA, you must ensure that you provide all information relevant to the handling of your request. This might include copies of your letters to the defending party and its responses to your letters. Please note that Dutch DPA mediation is free.
The Dutch DPA’s acceptance of mediation
The Dutch DPA is authorised to mediate in requests
for information about and the access to, supplementation,
correction, erasure and blocking of personal data, or
in objections to processing. The data in question must
be data to which the Wet bescherming persoonsgegevens
[Dutch Data Protection Act], the Wet politieregisters
(Wpolr) [Police Files Act] or the Wet justitiële
en strafvorderlijke gegevens [Judicial Data and Criminal Records Act] apply.
Where this is the case, the Dutch DPA will ascertain the statutory periods applicable,
whether or not the organisation in question is a government body and whether
or not you yourself have already undertaken all action possible, amongst other
things. If the Dutch DPA decides not to accept your request for mediation, you
will be informed of this decision as soon as possible and, where applicable,
referred to an organisation that will be able to help you.
Even if the
Dutch DPA is competent, it may decide not to consider a request for mediation.
For instance when the documents do not show that you have acted incorrectly or
the matter is of too little interest. The Dutch DPA will not start mediation
if a procedure in a court of law is more obvious or if you and the other party
are at a stalemate.
If the Dutch DPA decides not to accept your request
for mediation, you will be informed of this decision
as soon as possible and, where applicable, referred
to an organisation that will be able to help you.
The mediation process
If the Dutch DPA decides to initiate mediation, it will contact the party with which you have a conflict in order to give it the opportunity to explain its side of the story. In most cases it will contact this party in writing, but it is also possible to opt for a verbal (telephone) discussion of a case. Please note that it will not be possible for you to remain anonymous during mediation. In general, the defending party will receive a copy of all correspondence between you and the Dutch DPA, and you will usually receive copies of responses received from the defending party. Where the defending party raises new issues, the Dutch DPA will, where appropriate, ask you to respond. The length of time needed for mediation will depend on the promptness with which you and the defending party respond to the Dutch DPA’s questions, amongst other things.
Information during mediation
Since you will generally receive a copy of all correspondence between the Dutch DPA and the defending party, you will be able to follow the mediation process closely. However, should you have any questions, please contact the person responsible for your case. His or her name will be indicated in the top right-hand corner of letters that you receive from the Dutch DPA. When contacting the person responsible for your case, please have your case number at hand; this will enable him/her to help you without delay. Your case number is the number indicated under Reference (z2001-0829, for example) at the top of all Dutch DPA correspondence addressed to you.
The conclusion of mediation
Once the Dutch DPA has received a response from the other party, it will arrive at one of the following conclusions: either the Dutch DPA considers the defending party’s refusal to comply with your request to be valid, or your request is to be honoured. If the organisation continues to refuse to honour the request made by you, or fails to respond at all, the Dutch DPA will close the case. Of course, the Dutch DPA will also terminate its mediation when you are satisfied with the outcome achieved. This would apply, for example, when you have been permitted access to your data, or where your data have been corrected or erased.
Options following unsuccessful mediation
Where mediation has proved unsuccessful, you
will be able to take your case to a court of law. If
the defending party is a government body, you can lodge
an appeal with the administrative court. If the other
party is not a government body, you can request that
the court order the organisation to allow inspection,
correction or objection. In a letter to the court, you
could explain the request made by you to the organisation
in question, its refusal to comply with this request
and your failure to achieve a satisfactory result through
the Dutch DPA’s mediation. Please note that your
letter must be sent to the court within a period of six
weeks. This six-week period will commence on the date
on which the Dutch DPA’s letter was sent to you.
Although you will not be obliged to use the services
of a lawyer during these proceedings, you could choose
to consult one, or a Juridisch
Loket [Legal Desk].